CVE-2026-2684 Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload
Remote attackers can upload arbitrary files via the uploadFile.html endpoint, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2684?
CVE-2026-2684 is a medium-severity vulnerability in Tsinghua Unigroup Electronic Archives System, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-2684?
It affects 1 product.
Products include Unigroup Electronic Archives System.
How do I fix CVE-2026-2684?
No fix has been published for CVE-2026-2684 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2684 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2684 exists.
Other vulnerabilities in Tsinghua Unigroup Electronic Archives System
Sources
Also known as GHSA-3428-qfh5-9x74.